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O ! Abstract 



The focus of this paper is an information-theoretic study of retransmission protocols for rehable 



' packet communication under a secrecy constraint. The /lybrid automatic retransmission req'uest (HARQ) 

protocol is revisited for a block-fading wire-tap channel, in which two legitimate users communicate over 
a block-fading channel in the presence of a passive eavesdropper who intercepts the transmissions through 
an independent block-fading channel. In this model, the transmitter obtains a 1-bit ACK/NACK feedback 
' from the legitimate receiver via an error-free public channel. Both reliability and confidentiahty of secure 

HARQ protocols are studied by the joint consideration of channel coding, secrecy coding, and retrans- 



mission protocols. In particular, the error and secrecy performance of repetition time diversity (RTD) and 
incremental redundancy (INR) protocols are investigated based on good Wyner code sequences, which 
ensure that the confidential message is decoded successfully by the legitimate receiver and is kept in 
\l_ \ total ignorance by the eavesdropper for a given set of channel realizations. This paper first illustrates 

that there exists a good rate-compatible Wyner code family which ensures a secure INR protocol. Next, 



■ two types of outage probabihties, connection outage and secrecy outage probabilities are defined in 

order to characterize the tradeoff between the reliabihty of the legitimate communication link and the 
confidentiahty with respect to the eavesdropper's link. For a given connection/secrecy outage probability 
pair, an achievable throughput of secure HARQ protocols is derived for block-fading channels. Finally, 
both asymptotic analysis and numerical computations demonstrate the benefits of HARQ protocols to 
throughput and secrecy. 
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Index Terms 

Information-theoretic secrecy, HARQ, block-fading, rate compatible punctured codes, incremental 
redundancy, time diversity. 

I. Introduction 

Reliable communication is essential in applications of wireless packet-oriented data networks. A class 
of special coding schemes, the so-called hybrid automatic retransmission request (HARQ), combine 
powerful channel coding with retransmission protocols to enhance the reliability of communication links. 
Among currently available HARQ protocols, the most elementary form is the repetition-coding-based 
HARQ which combines several noisy observations of the same packet by using a suitable diversity 
technique at the receiver, such as maximal-ratio combining, equal-gain combining, or selection combining. 
A more powerful HARQ scheme is the so-called incremental redundancy HARQ, which achieves higher 
throughput efficiency by adapting its error correcting code redundancy to fluctuating channel conditions. 
In an incremental redundancy scheme, the message is encoded at the transmitter by a "mother" code. 
Initially, only a selected number of coded symbols are transmitted. The selected number of coded symbols 
form a codeword of a punctured mother code. If a retransmission is requested, additional redundancy 
symbols are sent under possibly different channel conditions. An information-theoretic analysis of the 
throughput performance of HARQ protocols over block-fading Gaussian collision channels is found in 
[1]. By assuming Gaussian random coding and typical-set decoding, the results of [1] are independent of 
the particular coding/decoding technique and can be regarded as providing a limiting performance in the 
information-theoretic sense. Another line of recent research on HARQ concerned with various mother 
codes and their puncturing can be found in [2]-[8]. 

Confidentiality is a basic requirement for secure communication over wireless networks. We note that 
the broadcast nature of the wireless medium gives rise to a number of security issues. In particular, wireless 
transmission is very susceptible to eavesdropping since anyone within communication range can listen 
to the traffic and possibly extract information. Traditionally, confidentiality has been provided by using 
cryptographic methods, which rely heavily on secret keys. However, the distribution and maintenance of 
secret keys are still open issues for large wireless networks. Fortunately, confidential communication is 
possible without sharing a secret key between legitimate users. This was shown by Wyner in his seminal 
paper [9]. In the discrete memory less wire-tap channel model he proposed, the communication between 
two legitimate users is eavesdropped upon via a degraded channel (the eavesdropper channel). The level 
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of ignorance of the eavesdropper with respect to the confidential message is measured by the equivocation 
rate. Perfect secrecy requires that the equivocation rate should be asymptotically equal to the message 
entropy rate. Wyner showed that perfect secrecy can be achieved via a stochastic code, referred to as 
Wyner secrecy code. Csiszar and Korner generalized this result and determined the secrecy capacity 
region of the broadcast channel with confidential messages in [10]. Recent research investigates multi- 
user communication with confidential messages, e.g., multiple access channels with confidential messages 
[11], [12], multiple access wire-tap channels [13], and interference channels with confidential messages 
[14]. The effect of fading on secure communication has been studied in [15]-[18]. More specifically, 
assuming that all communicating parties have perfect channel state information (CSI) prior to the message 
transmission, [15] has studied the delay limited secrecy capacity of wireless channels, while [16]-[18] 
have studied the secrecy capacity of an ergodic fading channel. [18] has also considered the ergodic 
scenario in which the transmitter has no CSI about the eavesdropper channel. 

In this paper, we investigate secure packet communication based on HARQ protocols. The challenge 
of this problem is twofold: first, the encoder at the transmitter needs to provide sufficient redundancy for 
the legitimate receiver to decode its message successfully; on the other hand, too much redundancy may 
help adversarial eavesdropping. As an example, retransmission is an effective way to enhance reliability, 
but nevertheless it may also compromise confidentiality. This motivates the joint consideration of channel 
coding, secrecy coding, and retransmission protocols. 

We consider a frequency-flat block-fading Gaussian wire-tap channel. In this model, a transmitter sends 
confidential messages to a legitimate receiver via a block-fading channel in the presence of a passive 
eavesdropper who intercepts the transmission through an independent block-fading channel. We assume 
that the transmitter has no perfect CSI, but receives a 1-bit ACK/NACK feedback from the legitimate 
receiver via a reliable public channel. Under this setting, we study the secure HARQ protocols from an 
information theoretic point of view. In particular, the error and secrecy performance of repetition time 
diversity (RTD) and incremental redundancy (INR) protocols are investigated based on good Wyner code 
sequences, which ensure that the confidential message is decoded successfully by the legitimate receiver 
and is kept completely secret from the eavesdropper for a given set of channel realizations of both the 
main and the eavesdropper channels. Next, we show that there exists a good rate-compatible Wyner 
code family which suits the secure INR protocol. Due to the absence of CSI, the transmitter cannot 
adapt its code and power level to channel conditions. Instead, for a given mother code, we consider the 
outage performance of secure HARQ protocols. Specifically, we define two types of outage: connection 
outage and secrecy outage. The outage probabilities (i.e., the probabilities of connection and secrecy 
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outage) are used to characterize the tradeoff between the rehabiUty of the legitimate communication link 
and the confidentiality with respect to the eavesdropper's link. We evaluate the achievable throughput of 
HARQ protocols under the constraints on these two outage probabilities. Finally, we compare the secrecy 
throughput of two HARQ protocols through both numerical computations and an asymptotic analysis, 
and illustrate the benefit of HARQ schemes to information secrecy. 

Generally speaking, when the coding parameters (main channel code rate and secrecy information rate 
for ensuring reliability and secrecy, respectively) can be freely chosen, INR can achieve a significantly 
larger throughput than RTD, which concurs with the results not involving secrecy where it has been 
shown that mutual-information accumulation (INR) is a more effective approach than SNR-accumulation 
(RTD) [1]. However, when one is forced to ensure small connection outage for the main channel even 
when it is bad, one is forced to reduce the main channel code rate. The INR scheme, having a larger 
coding gain (to both the intended receiver and the eavesdropper), needs to sacrifice a larger portion of 
the main channel code rate in order to satisfy the secrecy requirement. Hence, when the main channel 
code rate is bounded due to the connection outage constraint, the achievable secrecy throughput of INR 
may be smaller than that of RTD. This result deviates from that not involving secrecy. 

The remainder of this paper is organized as follows. We describe the system model and preliminaries in 
Section ini In Section JIIJ we prove the existence of good Wyner codes for parallel channel communication 
and define outage events, while these results are applied to INR and RTD protocols in Section |lVl We 
derive the secrecy throughput of two protocols over block fading channels in Section |Vl and present an 
asymptotic analysis in Section |Vll We illustrate and compare the various results and protocols numerically 
in Section I VII I Finally, we give conclusions and some interesting directions for future research in 
Section IVIIII The proofs of the results are provided in appendices. 

II. System Model and Preliminaries 

A. System Model 

As shown in Fig. \T\ we consider a model in which a transmitter sends confidential messages to a 
destination via a source-destination channel (the main channel) in the presence of a passive eavesdropper 
which listens to the transmission through a source-eavesdropper channel (the eavesdropper channel). Both 
the main channel and the eavesdropper channel experience M-block fading, in which the channel gain 
is constant within a block while varying independently from block to block [19], [20]. We assume that 
each block is associated with a time slot of duration T and bandwidth W; that is, the transmitter can 
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Fig. 1. System model: hybrid ARQ protocols for the block-fading channel in the presence of a passive eavesdropper 



send = [2VFTJ real symbols in each slot. Additionally, we assume that the number of channel uses 
within each slot (i.e., N) is large enough to allow for invoking random coding arguments^ 

At the transmitter, a confidential message it; G W is encoded into a codeword x^'^^ , which is then 
divided into M blocks [xi , ■ ■ ■ , x'^j], each of length A^. The codeword x^^^ occupies M slots; that 
is, for i = 1, ... , M, the i-th block x^ is sent in slot i and received by the legitimate receiver through the 
channel gain hi and by the eavesdropper through the channel gain gi. A discrete time baseband-equivalent 
block-fading wire-tap channel model can be expressed as follows: 

y{t) = \fhix{t) + v{t) 

and z{t) = y/g'ix{t) + u{t) for t = 1, . . . , MN, i = \t/N"\ , (1) 

where x{t) denotes the input signal, y{t) and z{t) denote the output signals at the legitimate receiver 
and the eavesdropper, respectively, at time t {t = 1, . . . ,MN), {v{t)} and {u{t)} are independent and 
identically distributed (i.i.d.) J\f{0, 1) random variable sequences, and hi and gi, for i = 1, . . . , M, denote 
the normalized (real) channel gains of the main channel and the eavesdropper channel, respectively. 
Furthermore, we assume that the signal x{t) has constant average energy per symbol 

E[\x{t)f] < P. (2) 

'For example, in a 64 kb/s down-link reference data channel for universal mobile telecommunications system (UMTS) data- 
transmission modes, each slot can contain up to TV ~ 10000 dimensions [21]. 
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Let h = [hi, . . . ^Hm] and g = [gi, . . . , gM] denote vectors whose elements are the main channel gains 
and the eavesdropper channel gains, respectively. We refer to (h, g) as a channel pair and assume that 
the legitimate receiver knows its channel h, while the eavesdropper knows its channel g. 

B. Wyner Codes 

In this subsection, we consider a single-block transmission, i.e., M = 1 and introduce Wyner codes 
[9], which are the basis of our secure HARQ protocols. 

Let C{Ro, Rs, N) denote a Wyner code of size 2^^" to convey a confidential message set W = 
{1,2,..., 2^^=}, where i?o > Rg and is the codeword length. The basic idea of Wyner codes is to 
use a stochastic encoder to increase the secrecy level [9], [10]. Hence, there are two rate parameters 
associated with the Wyner code: the main channel code rate Rq and the secrecy information rate Rg^ 
The Wyner code C{Ro, Rg, N) is constructed based on random binning [9] as follows. We generate 
2NR0 codewords x^{w,v), where w = 1,2, ...,2^^% and v = 1, 2, . . . , 2^^^""^=^ by choosing the 
N2^^° symbols Xi{w,v) independently at random according to the input distribution p{x). A Wyner 
code ensemble C{Ro, Rg, N) is the set of all possible Wyner codes of length N, each corresponding to 
a specific generation and a specific labeUng. 

The stochastic encoder of C{Ro, Rg, N) is described by a matrix of conditional probabilities so that, 
given w G W, we randomly and uniformly select v from {1, 2, . . . , 2^^^""^=)} and transmit = 
x^{w, v). We assume that the legitimate receiver employs a typical-set decoder. Given , the legitimate 
receiver tries to find a pair {w,v) so that x'^{w,v) and are jointly typical [22], i.e., 

{x^(u),^),2/^}Gr,^(Pxy). 

If there is no such jointly typical pair, then the decoder claims failure. 

Assume that signals and are received at the legitimate receiver and the eavesdropper, respec- 
tively, via a channel pair {h,g). The average error probability is defined as 

p^(h) = {0(y^(u;)) ^w\h,w sent} Pr(w;), (3) 

where 0(y^(w)) is the output of the decoder at the legitimate receiver and Pr(u;) is the prior probability 
that message G W is sent. 

^We call Ro — Rs the secrecy gap as the rate sacrificed to ensure the secrecy requirement. 
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The secrecy level, i.e., the degree to which the eavesdropper is confused, is measured by the equivo- 
cation rate at the eavesdropper. Perfect secrecy is achieved if for all e > the equivocation rate satisfies 

^H{W\g,Z'')>^H{W)-e. (4) 

For conciseness, we say that a code C of length N is good for a wire-tap channel with the channel pair 
(/i, g) if Pe{h) < e and the perfect secrecy requirement ^ can be achieved, for all e > and sufficiently 
large A^. 

C. Secure HARQ Protocols 

We first consider a general (in M) secure HARQ protocol for a block-fading wire-tap channel. The 
transmitter encodes the confidential information (and cyclic redundancy check (CRC) bits) by using a 
mother code of length MN. The obtained codeword x^^^ is partitioned into M blocks represented as 
[xi , ■ ■ ■ , x^]. At the first transmission, the transmitter sends the block x^ under the channel gain pair 
{hi,gi). Decoding of this code is performed at the intended receiver, while the secrecy level is measured 
at the eavesdropper. If no error is detected, the receiver sends back an acknowledgement (ACK) to stop 
the transmission; otherwise a negative acknowledgement (NACK) is sent to request retransmission, and 
the transmitter sends the block X2 under the channel gain pair (/12, 92)- Now, decoding and equivocation 
calculation are attempted at the receiver and eavesdropper by combining the previous block x^ with the 
new block x^. The procedure is repeated after each subsequent retransmission until all M blocks of 
the mother code are transmitted or an HARQ session completes due to the successful decoding at the 
intended receiver. 

Now, we focus on the error performance and secrecy level after m transmissions, m = 1, 2, . . . , M. 
Let 

x{m) = [x^,...,x^], y(m) = [yf and z{m) = [z^ , . . . , z^] 

denote the input, the output at the intended receiver, and the output at the eavesdropper after m transmis- 
sions, respectively. For a given channel pair (h, g), the average error probability after the m transmissions 
is defined as 

Peim\h) = ^ Pr {(f>{Ym{w)) / w\w sent, h} Pr(w), (5) 

where (piYmiw)) denotes the output of the decoder at the legitimate receiver after m transmissions. 
The secrecy level after m transmissions is given by 

^H(W|Z„,g). 
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We say that perfect secrecy is achieved after m transmissions if, for all e > 0, the equivocation rate 
satisfies 

_i_H(M/|Z„,g)>-l,if(»')-.. (6) 

We note that this definition implies that the perfect secrecy can also be achieved after j transmissions, 
for j = 1, . . . ,m — 1. 

Similar to the definition of good codes for a single-block transmission, we say that a code C of length 
mN is good for the m-block transmission and a channel pair (h,g) if Pe{m\h.) < e and the perfect 
secrecy requirement Q can be achieved, for all e > and sufficiently large N. 

In particular, we consider the following two secure HARQ protocols based on different mother codes 
and different combination techniques. 

1 ) Incremental Redundancy: In the INR secure HARQ protocol, the mother code is a Wyner code of 
length MN, i.e., 

C (^C{Ro,Rs,MN). 

In the first transmission, the transmitted coded symbols x(l) = [x^] form a codeword of a punctured 
Wyner code of length A^, 

Ci eC{MRo,MRs,N). 

Similarly, after m transmission, m = 1, . . . , M, the (all) transmitted coded symbols x(m) = [x^ , . . . , x^] 
form a codeword of a punctured Wyner code of length mN, 

^^fMRo MRs 

Cm G C , ,mN 

\ m m 

At the legitimate receiver and the eavesdropper, decoding and equivocation calculation are attempted, 
respectively, based on the punctured code Cm- 

We note that the punctured codes {Cm, Cm-i, ■ ■ ■ > Ci} form a family of rate-compatible Wyner 
codes with the secrecy rates 

M 

Rf, "TT Rf, • • • 5 MRt 

M -I 

Hence, we refer to this protocol as the INR protocol based on rate-compatible Wyner codes. 

2) Repetition Time Diversity: We also consider a simple time-diversity HARQ protocol based on the 
repetition of a Wyner code. In this case, the mother code C is a concatenated code consisting of the 
Wyner code Ci G C {MRq, MRg, N) as the outer code and a simple repetition code of length M as the 
inner code, i.e., 

C= [Ci,Ci,...,Ci]. (7) 

V ' 

M 
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After each transmission, decoding and equivocation calculation are performed at the receiver and the 
eavesdropper, respectively, based on maximal-ratio packet combining. 

III. Secure Channel Set and Outage Events 

In this section, we study the error performance and the secrecy level when a mother Wyner code is 
transmitted over M parallel channels. Results given in this section form the basis for the performance 
analysis of secure HARQ protocols. 

For a given Wyner code, an important practical question is: under what channel conditions will the 
communication be reliable and secure? In the following theorem, we describe a secure channel set and 
demonstrate that there exists a Wyner code sequence good for all channel pairs in this set. 

Theorem 1. Let V denote the union of all channel pairs (h, g) satisfying 

1 

-5]/(X;y|/iO>iio (8) 

i=l 
1 *^ 

and —Y.I{X;Z\gi)<Ro-Rs, (9) 

i=l 

where I{X;Y\hi) and I{X;Z\gi) are single letter mutual information characterizations of the channel 
([7]). There exists a Wyner code C G C{Ro, Rg, MN) good for all channel pairs (h, g) G V. 

Proof: A proof of Theorem [T] is provided in Appendix [A] ■ 
In the system model described in SectionUll the transmitter does not have any channel state information; 
that is, one cannot choose the code based on a particular fading channel state. Hence, it is important to 
show that there exists a Wyner code sequence good for all channel pairs in the secure channel set V. 

To facilitate the formulation of outage-based throughput, we define that an outage event occurs when 
the channel pair does not belong to the secure channel set, i.e., (h, g) ^ V. Specifically, we distinguish 
two types of outage: connection outage and secrecy outage. In particular, we say that a connection 
outage occurs if 

1 ^ 

— <i?o, (10) 

i=l 

^The main channel is viewed as a communication link. The link is connected if a packet can be delivered to the intended receiver 
successfully within the delay constraint (within AI transmissions), otherwise it is in the connection outage. The connection outage 
probability defined in this paper is also referred to as information outage probability in [19]. 
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while we say that a secrecy outage occurs if 

1 

— Y^I{X-Y\gi)>R^-Rs. (11) 

i=l 

Accordingly, we can evaluate both connection outage and secrecy outage probabilities, which are the 
probabilities of each of the outage events averaged over all possible fading states. In fact, the connection 
outage probability can be interpreted as the limiting error probability for large block length packets; the 
secrecy outage probability can be regarded as an upper bound on the probability of unsecured packets. 
Moreover, Theorem [T] implies that the connection outage probability and the secrecy outage probability 
are not just average probabilities over a code ensemble, but they can be achieved by a deterministic code 
sequence. 

IV. Secure HARQ with Wyner Codes 

In this section, we evaluate the error performance and measure the secrecy level during secure HARQ 
sessions. 

A key part of an ARQ protocol is that decoding errors should be detected, so that ACKs or NACKs can 
be generated accurately. A complete decoding function (e.g. maximum a posteriori probability decoding 
or maximum-likelihood decoding) requires the encoder to add extra redundancy to the information bits, 
which decreases the throughput slightly. The authors of [1] have shown that error detection can be 
accomplished by using the built-in error detection capability of suboptimal decoders. 

Lemma 1. [1, Lemma 3] For all e > and channel h, any code C of length MN satisfies 

Pr (undetected error|h, C) < e, 

for all sufficiently large N. 

Proof: The proof follows similarly to that given in [1]. ■ 

A. Incremental Redundancy 

To evaluate the performance of the INR protocol, we employ the following M -parallel channel model. 
Let us focus on the decoding after m transmissions, i.e., the coded blocks x(m) = [x^ , . . . are 
transmitted, m = 1, . . . , Af . As shown in Fig. |2l the block xf experiences channel pair {hi,gi), i = 
1, . . . ,m. We assume that each of the punctured blocks [x^^j^, . . . , x^] is sent to a dummy memoryless 
component channel whose output is independent of the input. 
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Fig. 2. M-parallel channel model for the INR protocol: the first m punctured blocks are actually transmitted (solid lines); 
the remaining M — m punctured blocks are assumed to be sent via M — m dummy memoryless channels whose outputs are 
independent of the inputs (dashed lines). 



In this case, the mother codeword is transmitted over M parallel channels. At the legitimate receiver, the 

TV 1 
M-mi 



decoder combines the real signal y(m) = [y^ , . . . , with M—m dummy signal blocks [6^, . . . 



to form 

L.N ,,7V ,Af f^N 1 

[yi T ■ ■ iVm^Oi , . . . , Oj^,j_mJ. 

Similarly, the processed symbols at the eavesdropper are 

r AT N jN jN 1 

1^1 ) • • • 5 ^rrn "l ; ■ ■ ■ ) "M-mJ ' 

where [d^, . . . , are M — m dummy signal blocks. We note that the added dummy blocks do not 

affect either the decoding at the legitimated receiver or the equivocation calculation at the eavesdropper 
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since they are independent of the confidential message. 

The codewords of the mother Wyner code C are transmitted in at most M transmissions during the 
secure HARQ session. By using the equivalent parallel channel model, we can describe this secure HARQ 
problem as communication over M parallel wire-tap channels and, hence, establish the following theorem. 

Theorem 2. Consider the secure INR protocol based on rate compatible Wyner codes 

{Cm,Cm-i, ■ ■ ■ , Ci}, 

where 

C^^c(^,^,mN], m = l,...,M. 
\ m m J 

Let V{m) denote the union of all channel pairs (h, g) satisfying 

— ^I{X;Y\hi)>Ro, (12) 

i=l 
^ m 

and — < ^o-^s. (13) 

i=l 

Then, there exists a family of rate compatible Wyner codes {Cm-, Cm~i, ■ ■ ■ , Ci} such that Cm is good 
for all channel pairs (h, g) G V{m), for i = 1, . . . , M. 

Proof: We provide a proof of Theorem |2] in Appendix |Bj ■ 

B. Repetition Time Diversity 

In the RTD secure HARQ protocol, both the legitimate receiver and the eavesdropper combine several 
noisy observations of the same packet based on diversity techniques. The optimal receivers perform 
maximal-ratio combining (MRC), which essentially transforms the vector channel pair (h, g) into a 
scalar channel pair {h{m), g{m)). Hence, after m transmissions, the equivalent channel model can be 
written as follows: 

y{t) = \Jh{m)x{t) + v{t) and z{t) = g{m)x{t) + u{t) (14) 

for t = 1, . . . , iV, where h{m) = Yh=i hi and g{m) = J2"Li 9i- 
Let £(m) denote the union of all channel pairs (h, g) satisfying 

I{X;Y\h{m))> MRo, (15) 
and I{X- Z\g{m)) < M{Ro - Rs), (16) 
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where I{X;Y\h{m)) and I{X; Z\g{m)) axe single letter mutual information characterizations of the 
channel (fT4l) . For a given (finite) M, we have the following result for the RTD secure HARQ protocol. 

Corollary 1. There exists a Wyner code Ci £ C {MRq, MRs, N) such that its m-repeating code 

Cm = [Cl, Ci, . . . , Ci] 
-V ' 

m 

is good for all channel pairs (h, g) G C{m), for m = 1, . . . , M. 

Proof: The proof follows directly from Theorem [T] by setting M = 1. ■ 

V. Secrecy Throughput of HARQ Protocols 

In this section, we study the achievable secrecy throughput for HARQ protocols. We focus on Rayleigh 
independent block fading channels for illustration; other types of block fading channels can be studied 
in a similar way. 

We note that the optimal input distribution of the channel ([T]) is not known in general when the 
transmitter has no CSI. For the sake of mathematical tractability, we consider Gaussian inputs. For INR, 
the mutual information /^y^^ (m) and {m) can be written as 

4r'M = ^f;iog2(i+A.) 

1=1 

^ m 

and 45^1 (m) = ^ ^ l°g2 + , (IV) 

1=1 



where 



Xi = hiP and = giP, i = l,...,M, (18) 



are the signal-to-noise ratios (SNRs) at the legitimate receiver and the eavesdropper, respectively, during 
transmission i. For RTD, we can express the mutual information quantities (m) and {m) as 



[RTD] , 

I I I, I 

2M 



and ™] (m) = ^ log^ + u}j . (19) 

Although we consider only Gaussian signaling here, the results in Section |IV] can be applied to other 
input distributions, for example, discrete signaling under modulation constraints. 



14 



Let M denote the number of transmissions within a HARQ session. Given a distribution of the main 
channel SNR A, for both INR and RTD protocols, the probability mass function of M. can be expressed 
as 

p[M = m] = Pr {/xy(m - 1) < i?o and IxYim) > Rq} 

= Pr {IxY{m - 1) < Ro} - Pr {/xy (m) < Ro} , m = 1, . . . , M - 1, 

and p[M = M] = Pr {Ixy(.M - 1) < Rq} , (20) 

where Ixyim-) and Ixz{n^) are chosen either from ([T9l ) or from ( fTTl ) corresponding to a specific HARQ 
protocol. Let Pe denote the connection outage probability, and Pg denote the secrecy outage probability. 
The definition in (l20l ) implies that Pg and P^ can be written as follows: 



Pe = Pr{/xy(M) <i?o}, (21) 

M 

and P^ = Y1 PHPr {Ixz{m) > Rq - i? J . (22) 

m=l 

Now, we study the secrecy throughput based on Pf. and Pg. We first consider a target secrecy outage 
probability ^g', that is, at least a fraction 1 — of the confidential message bits sent by the transmitter 
are kept completely secret. Under this constraint, the secrecy throughput rj, measured in bits per second 
per hertz, is defined to be the average number of bits decoded at the legitimate receiver, 

r?=lim^, (23) 

where again N is the number of symbols in each block and a{t) is the number of information bits 

successfully decoded by the intended receiver up to time slot t (when a total of tN blocks are sent). The 

event that the transmitter stops sending the current codeword is recognized to be a recurrent event [23]. 

A random reward TZ is associated with the occurrence of the recurrent event. In particular, IZ = MRg 

bits/symbol if transmission stops because of successful decoding, and 7^ = bits/symbol if it stops 

because successful decoding has not occurred after M transmissions. By applying the renewal-reward 

theorem [1], [23], we obtain the secrecy throughput as 

miZ] MRg , 
'''^•^•' = EM = iEl4<' 
where E[A1] is the expected number of transmissions in order to complete a codeword transmission, i.e., 

M 



m=l 

M 

= l+^Pr{/xy(m)</2o}. (25) 



m=l 
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We can properly choose the mother code parameters {Rq and Rg) to obtain the maximum throughput 
while satisfying -secrecy requirement. Hence, we consider the following problem 

max r]{RQ,Rs) (26) 

S.t. Ps<^s- 

The optimization problem (l26l ) imposes a probabilistic service requirement in terms of confidentiality; 
that is, the service quality is acceptable as long as the probability of the secrecy outage is less than 
^s, a parameter indicating the outage tolerance of the application. Note that Ps is a decreasing function 
of Rs, and r] is linearly proportional to Rg. Hence, we can solve the optimization problem (l26l ) in the 
following two steps: first, for given M, Rq, and ^s, we find the maximum value R*{Ro); next, we obtain 
the optimum Rq, which maximizes the secrecy throughput r]{RQ, RI{Rq)). 

On the other hand, reliability is another important quality of service parameter. To achieve both the 
connection outage target and the secrecy outage target ^s, we consider the following problem 

max r]{Ro,Rs) (27) 

S.t. p. <6, Pe<^e. 

In addition to the service requirement of confidentiality, problem (|27] ) also imposes a probabilistic service 
requirement on the connection outage, i.e., at least a fraction 1 — of HARQ sessions are successful. The 
connection outage constraint ensures that, at the expense of possibly lower average throughput, the delay 
constraint (that a packet can be delivered within M transmissions) is satisfied 1 — .^^ of the time, hence 
enabling applications which trade average rate for decoding delay like voice communication systems, 
e.g., CDMA2000 [24]. A similar constraint has been considered in [25] in terms of service outage for 
parallel fading channels. 

To evaluate p[m\, P^ and P,, we need the cumulative distribution functions (CDFs) of Ixvifn) and 
Ixzi'm)- For the RTD protocol, we can use the fact that Xll^i ^"^^ Y^T=i ^« gamma distributed to 
express the CDFs of {m) and /^J^' {ni) in terms of incomplete gamma functions. In the case of the 

INR protocol, the distributions of /^y^' {m) and /^^^^ [m) cannot be written in a closed form. Hence, we 
resort to Monte-Carlo simulation in order to obtain empirical CDFs. Note that Monte Carlo simulation is 
needed only to estimate empirical CDFs, while {R^, R*) is found numerically by a (non-random) search. 
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VI. Asymptotic Analysis 

In general, the secrecy throughput of the INR protocol is difficult to calculate since there is no closed 
form available for Pr{/xy(?7i) < Rq}. In this section, we consider the asymptotic secrecy throughput, 
which does have a closed form. 

We are interested in asymptotic results as M increases without bound. Note that this asymptote 
corresponds to a delay-unconstrained system. In this case, secure HARQ protocols yield zero packet 
loss probability, i.e., the transmission of a codeword ends only when it is correctly decoded. As a result, 
the problems (l26l ) and (|27] ) yield the same throughput, which can be obtained from (l24l ) as follows: 

MRs MRs 

"(^"■^•> = iEM-i + E!:f.,Prfc(»)<iio)- ™ 

Let us consider how to choose a mother Wyner code for the INR protocol in order to meet reliability 
and confidentiality constraints when M is large. Let A and u denote the instantaneous SNRs at the 
legitimate receiver and the eavesdropper, respectively. 

Lemma 2. Consider an INR secure HARQ protocol with the mother Wyner code C G C{Rq, Rs, MN). 
Then 

lim PPNR] ^ Q pJiNR] ^ 0^ (29) 



if and only if 



Ro < ^E[log2(l + A)] 

and Ro-Rs>Ro ^\, (30) 

E[log2(l + A)] 



where the expectations are over A and/or u. Furthermore, if d30D does not hold, then 

either lim Pj™^! = 1 or lim P]™^! = L (31) 

Proof: A proof of Lemma |2] is given in Appendix O ■ 
For comparison, we consider the situation in which the Wyner code C is transmitted over M-block 
fading channel without using the HARQ protocol. We refer to this case as the M-fading-block (MFB) 
coding scheme. Theorem [T] implies that, by using the MFB scheme, the requirement ( [29l ) can be achieved 
if and only if 

i?o < ^E[log2(l + A)] 
and Ro-Rs> ^E[log2(l + u)]. (32) 
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We note that the condition (l30l) for the INR protocol is weaker than the condition (l32l ) for the MFB 
scheme. In other words, the INR scheme can achieve the confidentiaUty and reUabiUty requirements more 
easily than can the MFB coding scheme by using the same Wyner code. This result illustrates the benefit 
of the INR secure HARQ protocol. 

Based on Lemma [2j we have the following asymptotic result concerning the achievable throughput for 
secure HARQ protocols. 

Theorem 3. We consider the secure HARQ protocols over a block-fading wire-tap channel. If the secrecy 
information rate Rq satisfies 

lim -j— = 0, (33) 

M^ooMRs 

then the secrecy throughput of RTD and INR protocols can be written as follows: 

{0 RTD 
(l/2)E[log2(l + A)-log2(l + z^)] INR 
where A and v are the instantaneous SNRs at the legitimate receiver and the eavesdropper, respectively. 

Proof: We provide a proof in Appendix |D] ■ 
We note that the RTD protocol involves suboptimal coding schemes, for which E[A^] grows faster 
than MRs in ( |28l ). Hence, the limiting secrecy throughput t] is zero. Theorem [3] again asserts the benefit 
of INR over RTD. 



VII. Numerical Results 

In our numerical examples, we consider Rayleigh block fading, i.e. the main channel instantaneous 
SNR A has the probability density function (PDF) /(A) = {1/X)e~'^^'^, and the eavesdropper channel 
instantaneous SNR i' has the PDF f{u) = (Xji'^e^'^l^ , where A and v are the average SNRs of the main 
and eavesdropper channels, respectively. 

To illustrate how the secrecy throughput t] is related to the choice of i2o (and R^), we give a numerical 
example of r\ versus Rq in Fig.[3l in which the parameter settings are as follows: the main channel average 
SNR A is 15dB, the eavesdropper channel average SNR v is 5dB, the maximum number of transmissions 
M is 8. (We observe that similar results are obtained by using other parameter settings.) For each i?o, we 
obtain the maximum i?*(i?o) that meets the secrecy constraint = 1, 10~^ or 10~^, respectively. When 
there is no secrecy constraint = 1), due to the sub-optimality of the RTD scheme, the RTD curve 
is uniformly below the INR curve. This does not happen when there is a secrecy constraint. The reason 
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Fig. 3. Secrecy throughput rj versus the main channel code rate _Ro under different secrecy requirements ^s, where the main 
channel average SNR is 15dB, the eavesdropper channel average SNR is 5dB, and the maximum number of transmissions is 
M = 8. 



is that INR not only favors the information transmission to the intended receiver, but also benefits the 
eavesdropping by the eavesdropper. Hence, INR needs to sacrifice a larger portion of the main channel 
code rate than RTD in order to keep the eavesdropper ignorant of the confidential messages. This is 
reflected in Fig. [3] that a larger Rq has to be chosen for INR (than RTD) in order to obtain a positive 
secrecy throughput. 

It is clear from Fig. [3] that there exists a unique Rq (and therefore RI{Rq)) to maximize -q for each 
parameter setting. For all secrecy constraints (.^^ = 1, 10~^ or 10~^), if the best Rq and RI{Rq) are 
chosen for each scheme accordingly, INR yields higher secrecy throughput than RTD does, which shows 
the benefit of INR over RTD. 

According to (1211 ). the choice of Rq decides the reliability performance. This is shown in Fig. IH where 
we plot the connection outage probability Pg versus the value of Rq. For both INR and RTD, Pg increases 
with the value of Rq. Note that a more strict secrecy constraint requires a larger Rq (as shown in Fig. 
[21), which however causes the degradation of the reliability performance. We can see that there exists a 
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Fig. 4. Connection outage probability Pe versus tlie main channel code rate Rq, where the main channel average SNR is 15dB, 
the eavesdropper channel average SNR is 5dB, and M — 8. 



tradeoff between secrecy and reliability. 

Given a strict connection outage constraint Pe < ^e, the choice of Rq (and R*{Rq)) might not be 
feasible. For instance, in order to obtain < 10~ , we need to choose < 0.38 and pj,™^^ < 1.25 

(marked with 'A' and 'B' respectively in Fig.[3]and Fig.©. Specifically, for a connection outage constraint 
Pe < 10^3, R^ is not feasible for INR when = 10^^, and R^ is not feasible for both INR and RTD 
when = 10~^ in Fig. [3l Note that for the case of = 10""^ (and = 10"'^), positive secrecy 
throughput cannot be obtained for INR, but can be obtained for RTD. This implies that RTD might 
outperform INR, when we have strict secrecy and connection outage constraints. This is a surprising 
result in the view of the well-known HARQ performance when there is no secrecy constraint, where INR 
always outperforms RTD [1]. 

In Fig.[5]and Fig.[6l we show the secrecy throughput rj under different target secrecy outage probabilities 
^s. There is no connection outage requirement in Fig. [5] There is an additional connection outage 
requirement of Pe < = 10~^ in Fig. (6] The parameter settings are A = 15dB, P = 5dB and M = 8. 
We can see that small secrecy outage probability can be achieved when the throughput is small for 
both protocols. The INR protocol outperforms the RTD protocol uniformly when there is no connection 
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Fig. 5. Throughput rj versus target secrecy outage probabihty ^s, when the main channel average SNR is 15dB, the eavesdropper 
channel average SNR is 5dB, and M = 8. 



outage requirement. However, when there is a strict connection outage requirement, the RTD protocol 
outperforms the INR protocol when is small (e.g., < 10~^). 

Fig. |7] illustrates the relationship between the secrecy throughput t] and the main channel average SNR 
A when there is a target secrecy outage probability = 10~^ and no connection outage requirement. The 
average SNR of the eavesdropper channel is fixed to be 5dB. We find that the INR protocol outperforms 
the RTD protocol significantly, especially when the main channel SNR is large. 

In Fig. [8j we show the secrecy throughput 77 versus the maximum number of transmissions M. 
Comparing with the secrecy throughput without the connection outage constraint, the secrecy throughput 
with a connection outage constraint (Pg < 10"'^) suffers some loss when M is small due to insufficient 
diversity. Both secrecy throughputs converge when sufficient diversity can be obtained as M increases. In 
particular, when M — > 00, both throughputs are the same and are given by (1281 ) in the asymptotic analysis. 
For INR, the secrecy throughput r/[™^l increases monotonically with M. For RTD, 7]^^™^ decreases with 
M due to its strongly suboptimal coding scheme. This concurs with the asymptotic analysis that, when 
M — > 00, a constant (nonzero) secrecy throughput (0.5 *E [log2(l + A) — log2(l + 1^)] = 1-31 according 
to Theorem 3) can be achieved for INR, while zero throughput can be obtained for RTD. 
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Fig. 6. Throughput rj versus target secrecy outage probabihty under connection outage probabihty ~ 10^'^, when the 
main channel average SNR is 15dB, the eavesdropper channel average SNR is 5dB, and M — 8. 

VIII. Conclusions and Future Directions 

In this paper, we have studied secure packet communication over frequency-flat block-fading Gaussian 
channels, based on secure HARQ protocols with the joint consideration of channel coding, secrecy 
coding and retransmission protocols. From an information theoretic point of view, we have considered 
two secure HARQ protocols: a repetition time diversity scheme with maximal-ratio combining (RTD), 
and an incremental redundancy scheme based on rate-compatible Wyner secrecy codes (INR). We have 
proved the existence of good Wyner code sequences, which ensure that the legitimate receiver can decode 
the message and the eavesdropper can be kept ignorant of it for an HARQ session under certain channel 
realizations. 

To facilitate the formulation of the outage -based throughput, we have defined two types of outage: 
connection outage and secrecy outage. The outage probabilities, more specifically, the connection and 
secrecy outage probabilities have been used to characterize the tradeoff between the reliability of the 
legitimate communication link and the confidentiality with respect to the eavesdropper's link. We have 
evaluated the achievable throughput of RTD and INR protocols under probabilistic requirements (con- 
straints) on secrecy outage and/or connection outage, and have illustrated the benefits of HARQ schemes 
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Fig. 7. Throughput 77 versus main channel average SNR A under a target secrecy outage probability = 10 when the 
eavesdropper channel average SNR is 5dB and M = 8. 

to information secrecy through some numerical results and an asymptotic analysis. 

In general, INR can achieve a significantly larger throughput than RTD, which concurs with the results 
not involving secrecy that mutual-information accumulation (INR) is a more effective approach than 
SNR-accumulation (RTD). However, when one is forced to ensure small connection outage for the main 
channel even when it is bad, one is forced to reduce the main channel code rate. The INR scheme, 
having a larger coding gain (to both the intended receiver and the eavesdropper), needs to sacrifice a 
larger portion of the main channel code rate (i.e., requires a larger secrecy gap) in order to satisfy the 
secrecy requirement. Hence when the main channel code rate is bounded due to the connection outage 
constraint, the achievable secrecy throughput of INR may be smaller than that of RTD. 

We conclude this work by pointing out some future research directions. 

First, as pointed out in [26], many practical encoders are separated from the modulator and therefore 
the performance of HARQ protocols is impacted by modulation constraints. Although we have assumed 
Gaussian signaling, it is possible and also meaningful to extend the analysis to take discrete signaling 
into account. 

In our analysis, we have assumed random coding and typical set decoding. Future work should consider 
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Fig. 8. Throughput rj versus the maximum number of transmissions M under a target secrecy outage probabihty = 10 ^, 
when the main and eavesdropper channel average SNRs are 15dB and 5dB, respectively. 



practical coding and decoding schemes for secure HARQ protocols. Existing work on the practical secrecy 
code design includes coset coding [27], low-density parity check (LDPC) code design [28], and nested 
codes [29]. The design of practical rate compatible secrecy codes for Gaussian channels remains a 
challenging problem. 

Appendix A 
Proof of Theorem [T] 

For convenience, let p = (h, g) and V* denote the set of channel pairs (h, g) so that 

1 

— ^I{X;Y\h,) = Ro + 6 (34) 

i=l 

1 

and _^i(X;Z\g,) = Ro-Rs + S, (35) 

i=l 

where 5 > is arbitrarily small. It is clear that V^, QV when (5^0. 
In order to prove Theorem [T] we first consider the following lemma. 

Lemma A.l. There exists a code C G C{Ro, Kg, MN) that is good for any channel pair p G "P*. 



24 



A. Proof of Lemma A.l 

Proof: Following standard continuity arguments [22], we consider a quantization of the input and 
output of the channel ([T]) and work on the resulting discrete channel. Given a channel pair p = (h,g), 
on every fading block i G [1, A/], the channel is time-invariant and memoryless. Let x denote the input, 
and let y and z denote the outputs at the legitimate receiver and the eavesdropper, respectively. From 
the weak law of large numbers, we have the following limits in probability: 

lim llog2Pr(x) =-Mi7(X), 

N^oo iV 
1 

lim -\og^Priy)=-^HiY\h,), 

i=l 
M 



lim ^ log2 Pr(z) = - V H{Z\gi) 



TV^oo N 

i=l 

1 

lim -log2Pr(x,y) =-Vi/(X,y|/i,), 

1=1 

1 ^'^ 

and lim — logg Pr(x, z) = - V H{X, Z\gi), 

i=l 

where H{X) is the input entropy per letter; H(Y\hi) and H{Z\gi) are the output entropy per letter 
at the intended receiver and the eavesdropper, respectively, in block i = 1,...,M; and H{X,Y\hi) 
and H{X, Z\gi) are the joint entropies per letter in block i. Define the typical set as the set of all 
sequences (x, y, z) for which the above sample means are within e of their limits. 

The random coding ensemble C = C{Rq, Rg, MN) is constructed by generating 2^^^° codewords 
x{w,v), where w = 1, 2, . . . , 2^*'^^= and v = 1, 2, . . . , 2^*'-^(^°-^=), by choosing the {MN)2^^''^° 
symbols independently at random. Given w G W = {1, 2, . . . , 2^*^^=}, the encoder randomly and 
uniformly selects a v from {1,2,..., 2^*^(^o~^=)} and transmits x(tt;, v). 

1 ) Error Analysis: Given a message w G W, the legitimate receiver declares that x was transmitted, if 
X is the only codeword that is jointly typical with y. An error is declared if either x is not jointly typical 
with y, or there is another codeword x jointly typical with y. Let us denote this type of error as £i. By 
following the same steps in [22, Theorem 8.7.1], we obtain that Ecgc[Pr(<Si|p, C)], the probability of 
error £i averaged over the code ensemble C is 

Ecec[Pri£^\p,C)] < E Ift [i^,y) ^ T,'' (Pxy)] + Y.^r [ii,y) G T,"^ {Pxy)] 

[ x^x 

< e + (2^*^«° - l)E{Pr [(i,y) G r,^(Pxy)]} 
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= g + l^2^MRo _ i)2-^[^"i IiX;Y\h,)-e] 

< e + 2-^('5-). 

By choosing 5 > e, we have 

Ec6c[Pr(^^i|p,C] <ei, (36) 

for every channel pair p G "P* as the codeword length N is sufficiently large, where ei = e + 2~^('^~'^). 

Let B{w) denote the set of codewords corresponding to message w ^ W (bin w). Suppose that the 
eavesdropper gets to know w a priori, based on which it tries to determine which codeword was sent. 
The eavesdropper declares that x was sent, if x is the only codeword in B{w) that is jointly typical with 
z. An error is declared if either x is not jointly typical with z, or there is another codeword x in B{w) 
jointly typical with z. Denoting this type of error as £2, we obtain that E(7gc[Pr(£^2|P5 C*)], the average 
probability of error averaged over the code ensemble C is 



EcGc[Pr(^^2|p,C)] <E<^ 



Pr [(x,z) ^ ri^(Pxy)] + E [(^'^) e T,''iPxz),i G i?( 




< e + (2^*-^^« - 1)E {Pr [(x,z) G r,^(Pxz)] Pr [x G Biw)]} 

<e + 2-^(^-^). 
By choosing 5 > e, we have 

Ecgc[Pr(f2|p,C] < £2 (37) 

for every channel pair p G when the codeword length is sufficiently large, where €2 = e+2~^^^~^\ 
Now we define an error event £, which occurs whenever £1 or £2 occurs, i.e. 

£ = £iU£2. (38) 
According to (l36l ) and (|37] ). by using the union bound, we have for any p G P*, 

Ecec[P^{£\p,C)] < Ecec[Pr{£i\p,C)]+Ecec[Pr{£2\p,C)] 
< ei + £2 = £3- 

It is clear that the average error probability, averaged over the channel set is 

Epgp. [Ecec[Pr(£:|p,C)]] <e3. 
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Interchanging expectations with respect to p G "P^, and with respect to C E C (since the integrand is 
nonnegative and bounded by 1) yields 

Then, there exists a sequence of codes C* G C (for increasing N) such that 

Epev,[PT{£\p,C*)] < £3, 

where Pr(<5|p, C*) is a random variable that is a function of the channel pair p. According to the Markov 
inequality, we have 

By letting = (£4 is still arbitrarily small), we obtain that, for any p G "P*, 

Pr(Pr(^:|p,C*) >e4) <e4 
or Pr (Pr(<S|p, C*) < £4) > 1 - £4. (39) 

Since Pr(fi|p,C*) and Pr(<f2|p, C'*) are both upper bounded by Pr(<5|p,C*), we have that 

Pr (Pr(fi|p,C*) < £4) > 1 - £4 (40) 
and Pr (Pr(f2|p, C*) < €4) > 1 - £4. (41) 

According to (l40l ). there exists a (non-random) sequence of codes C* G C{Ro, Rs, MN), which when 
used, the legitimate receiver can decode the message with arbitrarily small error probability for all p G "P* 
with probability 1. Inequality (|4TI ) will be used in the equivocation calculation as followed. 

2) Equivocation Calculation: Now we calculate the equivocation rate to check whether the perfect 
secrecy requirement can be satisfied when codebook C* is used. 

We bound the equivocation at the eavesdropper as follows: 

/7(VF|Z,h,g) = if(iy,Z|h,g)-i/(Z|h,g) 

= H{W, Z, X|h, g) - H{Z\h, g) - H{y.\W, Z, h, g) 

= F(X|h, g) + H{W, Z|X, h, g) - ii'(Z|h, g) - H{y.\w, Z, h, g) 

> //(X|h, g) - /(X; Z|h, g) - i/(X|VF, Z, h, g). 

For the first term, we notice that 

i7(X|h,g) = iVMiJo. (42) 
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To bound the second term, we define 



MX,Z|h,g) 



Now 



1 if (X,Z) ^Tf(Pxz) 
otherwise. 



/(X;Z|h,g) < /(X,^;Z|h,g) 

= /(X;Z|h,g,^)+/(/i;Z|h,g) 
1 

= ^Pr(/i=j)/(X;Z|h,g,/x=j)+/(^;Z|h,g). (43) 

j=0 

Note that /(//; Z|h, g) < h{fi) < 1, 

Pr(M=l)/(X;Z|h,g,/i = l) < iVPr[(X,Z) ^Tf(Pxz)|h,g]log2|Z| 

< iVelog2|Z|, 

and 

Pr(^ = 0)/(X;Z|h,g,/x = 0) < /(X; Z|h, g, = 0) 

= H{X\h, g,fi = 0)+ H{Z\h, g,fi = 0)- H{X, Z|h, g, // = 0) 

M M 

< N MH{X) + Y,H{Z\gi)-Y,H{X,Z\gi) + 3e 



i=l 



i=l 



N 



M 



i=l 



Therefore, we can bound the second term as 



/(X;Z|h,g) < N 



M 



+ 1 



J2nX;Z\gi) + {log,\Z\+3)e 

i=l 

NM[Ro -Rs + 6- (log2 \Z\ + 3)e - 1/iV] 
NM{Ro- Rs + 6i). 



(44) 



To bound the third term, we need to use (|4T]) . according to which the eavesdropper can decode X with 
arbitrarily small error probability, given that W is known in prior and Z is observed. Fano's inequality 
implies that 

H(X\W, Z, h, g) < 1 + NM{Ro - Rs)Pr{£2\p, C*) = NM52 (45) 
for every channel pair p G P*- 
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Now we can combine (l42l) . (l44l ) and (1451 ) into the equivocation calculation: 

H{W\Z, h, g) > NMRq - NM{Ro - Rs + 6i) - NM62 

= NM{Rs- 53). (46) 

Note that the above equivocation calculation is obtained when (non-random) code C* is used, instead 
of the random code ensemble C{Ro, Rs,MN). Equation (l46l ) implies that the perfect secrecy requirement 
is met. This, together with the error probability analysis, implies that code C* is good for all channel 
pairs p G with probability 1. ■ 

B. Proof of Theorem |7] 

Proof: Now we show that code C* is also good for any channel pair p £ V. Note that for every 
p = (h, g) G V, there always exists at least a channel pair p* = (h*,g*) G V*, such that h ^ and 
g ^ g*- With the input X, we denote the outputs from the channel (h, g) at the legitimate receiver and the 
eavesdropper by Y and Z, respectively. We also denote by Yi and Zi the outputs at the corresponding 
receivers from (h*, g*). Since code C* is good for (h*, g^,), Yi can be decoded with arbitrarily small error 
probability at the legitimate receiver and the equivocation at the eavesdropper with Zi being observed 
satisfies 

H{W\Zi,g,)>H{W)-Ne (47) 

for all e > and sufficiently large N. Since h ^ h*, Yi is a degraded version of Y, and thus if Yi 
can be decoded at the legitimate receiver with arbitrarily small error probability, then so can Y. We also 
have that 

HiW\Z,g)-HiW\Z,,g,) 
= I{W;Z^\g,)-I{W;Z\g)>0, 
where we use the fact that Z is a degraded version of Zi, since g ^ g*. Therefore, 

H{W\Z,g) > H{W\Zi,g,) > H{W)-Ne, (48) 
for all e > and sufficiently large A^, which is the perfect secrecy requirement. ■ 

Appendix B 
Proof of Theorem [2] 

Proof: We note that the punctured code Cm is obtained by taking the first m blocks, x(?ti) = 
[x^, . . . ,x^i], of the mother code C, where the block xf is transmitted over a wire-tap channel with 
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channel pairs {hi,gi), for i = 1, . . . , m. Based on the equivalent M-parallel channel model, we can form 
a new sequence of channel pairs by adding other M — m dummy memoryless channels whose outputs 
are independent of the input. For example, we can let /ij = and (^j = for alH = ?n + 1, . . . , M. The 
dummy channel pairs have zero mutual information between the input and output; that is, 

M m 



Y,I{X-Y\hi) = Y,I{X-Y\h,) 



1=1 

M 



i=l 
m 



and 



Y,I{X-,Z\g,) = Y,I{X-Z\g,). 



i=l 



i=l 



Now, by using Theorem [T] and the fact V{m) C V, we have the desired result. 



Appendix C 
Proof of Lemma [2] 

Applying the weak law of large numbers, we have the following lemma that is used in the proofs of 
Lemma |2] and Theorem [3l 

Lemma C.l. Let Ai be i.i.d. random variables with means variances a\. Then, for alll e > 0, 

M 



lim Pr 

M^oo 



and 



lim Pr 



- ma) < 6 

i=l 

1 



i=l 



0. 



(49) 



Now, we consider the proof of Lemma |2] 

Proof: Define Ai = (1/2) log2(l + Aj) and its mean = lE[^j], and Bi = (1/2) log2(l + i^j) and 
its mean I-Lb = ]E[i?j], for i = 1, . . . ,M. The connection outage probability pj™^', defined in (|2TI ). can 
be rewritten as follows: 



By using Lemma C.l, we have, for all e > 0, 



lim Pj™!^] 
M^oo 



0, i?o < AiA - e 

1, Rq > liA + e- 



(50) 
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We first prove the sufficiency given by ( |29l ) in Lemma [2] and show that if 



^0 < A^A — e and Rq — Rs > Ro 



(51) 



then (129J| holds. 
Define 



Ml 



MRo 



(52) 



_fJ'A - e_ 

Note that (ISTl ) implies that Mi < M. Hence, we can bound the secrecy outage probability pj™^', defined 
in (l22l ). as follows: 

m=l V 1=1 / m=A/i+l V 1=1 ) 

/ A/i \ / , Afi \ A/ 

< 5^pH Pr -j;i?,>i2o-i?. + 5] pN 

\m=l / V j=l / m=A/i+l 



< Pr 



Pr 



< Pr 



Si > M(i?o - Rs 



.i=l 
Ml 



Pr (^^A<MRo^ 



EBi — fJ'B ^ M{Rq - Rs 
> 77 /^B 



.i=l 
■Ml 



Ml 



Ml 



■ A/i 



+ Pr 2^ < ^TT MA 



Ml 



Ml 



— —r > e{l-iA - e) 



i=l 



Ml 



■ A/i 



+ Pr 2^ ~r < — fJ'A 



.1=1 



Ml 



Ml 



(53) 



where the last step follows from the condition ( [511) and the definition of Mi in ( [52l ). Applying Lemma C.l, 
we have 

'Ml 



lim Pr 

M— >oo 



EBi- llB . , ^ 

— ^7 > e(AtA - e) 



li=l 



Ml 







(54) 



and 



■Ml 



T fV^^j-^A MRq 



■ Ml 



M-*oo \ ^ Ml 
\i=l 



Ml 



lim Pr ( — ^ , < — e 



Af-»oo \ ^ Ml 



0. 



(55) 



Combining and dSSjl, we have (|29l ). 

Next, we prove the necessity given by ( [3T| ) in Lemma |2] Based on (|50l ) we need only to show that if 



-Ro - -Rs < -Ro ( — - e ) and i^o < /^A + e, 



(56) 
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then liniM^oo Ps 



[INR] 



1. Define 



Mo 



'M{Ro - Rs) 



(57) 



where e2 = {fJ-A — Note that the condition (l56l ) imphes that M2 < M. In this case, we obtain the 
following lower bound on pj™^! : 

M 

Y,Bi> M{Ro - Rs 



.1=1 



Mn 



pJINR] > ^ ^[^]p^ 

m=M2 

/ M \ 

\m=M2 / 
/M2-I 

= Pr ( J]] < ilf i?o ) Pr 

Ai - HA 



Y,B^>M{Ro-Rs) 

M2 

Y,Bi>M{Ro-Rs) 



\ i=l 
/M2-I 

\ i=i 



< 



i=l 

MRo 



Mo - 1 Mo -I 



f^A Pr 



M2 



- ^ M(i?o - Rs) 



Mo 



> 



Based on the condition ( [56l ) and the definitions of M2 and £2, we have 



MRq 
Mo - 1 



MA 



Mi?o 



> 



> 



rM(i?o - - £2)1 - 1 

i2o 



M2 



-(Mb - £2) - fJ-A 



> 0. 



(58) 



By applying Lemma C. 1, we have 



M 



lim Pr( V 4^<#%-Ma| =1. 



M2 - 1 M2 - 1 



On the other hand, since 



Lemma C.l implies that 



lim Pr 

M~*oo 



M{Ro - Rs 
Mo 



( 1 



MB < -€2 < 0, 



Rq- Rs \ 

Mb)>^^^-Mb =1. 



Finally, combining (l50l ). (1581 ). (|59l ). and (l60l ). we have the necessity of Lemma |2] 



(59) 



(60) 
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Appendix D 
Proof of Theorem [3] 

To derive Theorem [3l we need the following lemmas from [1]. 

Lemma D.l. Suppose A be a random variable with CDF Fa- Then, for all a and a. we have 

FA{a) < FA{a) + l(a > a) (61) 
where l(-) denote the indicator function. 

Lemma D.2. Suppose {Ai} is a sequence of i.i.d. zero mean random variables with variances a\. Then, 
for all e > and sufficiently large n, 

J2 



Pr 



< exp ( —n 



2a\ 



(62) 



We note that Lemma D.2 follows from the central limit theorem and the bound on the Gaussian tail 
function, Q(a) < exp(— a^/2), where Q denotes the tail function of the standard Gaussian distribution. 



A. INK Protocol 

Proof: Again, we define Ai = (l/2)log2(l + Aj) with mean pA = ^[Ai] and variance a\, Bi 
(1/2) log2(l + i^i) with mean fiB = IE[i?i], for i = 1, . . . , M, and 

AIRo 



M4 



PA + e. 



The reliability condition in (1501 ) implies M4 < M. 

We first consider an upper bound of t^I™^] based on (1281) : 



/INR] < MR, 

< MRs 
MR, 



Mi 



^Fri^Ai<MRo 

m=l \i=l J 
Mi I Mi \ 

Y,Vy[Y,M<mr^ 



-1 



.m=l \i=l 

M. 



M4 



Pr 



^Ai-y^A ^ MRq 
2^ —T7 < - /^A 



,j=i 



M4 



M4 



Since MRq/M^ — /i/i e > 0, according to Lemma C.l, we have 

'M. 



lim Pr 

M^oo 



EAi - HA MRo 
—T7 < - l^A 



.1=1 



M4 



M4 



1. 



(63) 
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Hence, 



T flNRl ^ 1- MRs Rs 
M^oo M~*oo Rq 



Next, we consider a lower bound on t^I™^!. Let M5 = [Mi?o/(/iA — e)J. We have 



[INR] 



< 



1 



+ 



V 



MR, MR 



1 *^ 

— y 



m=l 



A 



MRn 



m 



(64) 



(65) 



1 + L(M) _^ M5 



where ( [65] ) follows from Lemma D.l and 



M / m \ 

L{M)=^Pri-Y^{A-^.A)<-e]. 

m=l \ i=l / 

By Lemma D.2, there exists an integer n, finite and independent of Rq, so that 

n / m \ M / ^ m \ 

L(M) = EpM-E(^^-/^^)<-^ + E - E(^^ - /^^x 

m=l \ j=l / m=n+l \ i=l / 

r?i=l \ i=l / m=n+ 



(66) 



exp —m — TT 



Since the first sum contains a finite number of terms (each being less than 1), and the second converges 
for all e > 0, we have that 



Hence, we have that 



1 + L(M) 
lim ^ — ^ = 0. 

M^oo MR. 



lim r?[l^l^] > lim ^ = ^/i^. 



Combining (1641 ) and (1671 ). we obtain 



lim r?[™^l = |^/.A = :^IE[log2(l + A)]. 
Furthermore, Lemma |2] implies that 

Rs^^ E[log2(l + z/)] 
i?o " E[log2(l + A)]" 

Finally, combining (l68l) and (|69l ). we have the desired result that 



(67) 



(68) 



(69) 



lim r/[™i^l = [log2(l + A) - log2(l + 1^)] 



M^oo 
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B. RTD Scheme 

Proof: We first consider the connection outage probability P^^™K Let Ai = Aj with mean /i^ 
E[Aj], for i = 1, . . . , M. Based on (|2TI ) we have 



p[RTD] 



Pr 


1 




2M 




/ M 


Pr 






\i=l 



< Ro 



A, - flA 22A-^«o - 1 

< — fJ-A 



M 



M 



lim P.PTD] 



0, ^(22^'^«o_i)<^^_, 



By using Lemma C.l, we have, for all e > 0, 

J_(r.2MRt 

A I 

1, ^(22A/«o-l)>/i^ + e 
Hence, to ensure the connection outage requirement, Rq should satisfy 

22MRo _ I 



M 

Now, we consider an upper bound on r?'^™]. Let 

/iA + e 

where the inequality follows from dTTT ). By using (l28l) . we have 

Ms / m 



< M, 



^[RTD] < ^^^^ 



1+ J^Pr J^^, <22^'^«°-l 



MRo 



A/, 



m=l \«=1 
/A/a 



.m=l \i=l 



< 



< ^J.A 



Since (22*^^0 - 1)/M3 - //a > e > and Lemma C.l, we have that 



■ AA 



™Pmz^ < — 



A/^oo 



Ms 



Ma 



1. 



Therefore, 



lim < lim ^ = lim ^^i^^^ + = 0. 



(70) 



(71) 
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